feat: settings page accessible to all authenticated users

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NfPpSpccTWBfZg1FTveyaU

hbd/server/http.py

@@ -1126,19 +1126,18 @@ async def start(
         return web.Response(text=body, content_type="text/html")
 
     # -------------------------------------------------------------------------
-    # Settings page (admin only)
+    # Settings page
     # -------------------------------------------------------------------------
 
     async def settings_page(request):
-        """GET /settings — read-only view of the current server configuration."""
+        """GET /settings — server configuration; non-admins see only what they own or manage."""
         current_user, _ = _require_auth_redirect(request)
-        if current_user and not current_user.admin:
-            raise web.HTTPForbidden(reason="Admin access required")
         pkg_dir = os.path.dirname(__file__)
         templates_dir = config.get("templates_dir", os.path.join(pkg_dir, "templates"))
         env = jinja2.Environment(loader=jinja2.FileSystemLoader(templates_dir), autoescape=True)
         tmpl = env.get_template("settings.html")
-        settings_data = settings_mod.get_settings_data(config, threshold_checker=threshold_checker)
+        settings_data = settings_mod.get_settings_data(
+            config, threshold_checker=threshold_checker, user=current_user)
         body = tmpl.render(
             title="Settings - Heartbeat",
             sections=settings_data["sections"],

hbd/server/templates/nav.html

@@ -6,12 +6,12 @@
     <a href="/live"{% if active_page == "live" %} class="active"{% endif %}>Live Dashboard</a>
     <a href="/plugins"{% if active_page == "plugins" %} class="active"{% endif %}>Host Overview</a>
     <a href="/alerts"{% if active_page == "alerts" %} class="active"{% endif %}>Alerts</a>
-    {% if current_user and current_user.admin %}
+    {% if current_user %}
     <a href="/settings"{% if active_page == "settings" %} class="active"{% endif %}>Settings</a>
     {% endif %}
     <a href="/about"{% if active_page == "about" %} class="active"{% endif %}>About</a>
   </div>
-  {% if current_user and current_user.admin %}
+  {% if current_user %}
   <button id="nav-publish-btn" class="nav-publish-btn" onclick="navPublishConfig()" style="display:none" title="Publish pending config changes to .hb.yaml">&#9888; Publish Config</button>
   {% endif %}
   <div class="nav-pie" title="Host alert status">